# KMS CLI Commands

## `encrypt`

* **Encrypts plaintext into ciphertext** by using a CMK.

## `decrypt`

* **Decrypts ciphertext that was encrypted by a KMS CMK**.

## `sign`

* **Creates a digital signature for a message** or message digest by using the private key in an asymmetric CMK.\\

* **To verify the signature, use the `verify` operation**, or use the public key in the same asymmetric CMK outside of KMS.

## `create-grant`

* **Adds a grant to a CMK**.\\

* The **grant allows the grantee principal to use the CMK when the conditions specified in the grant are met**.\\

* When setting permissions, grants are an **alternative to key policies**.

## `revoke-grant`

* **Revokes the specified grant for the specified CMK**.

## `generate-data-key`

* **Generates a unique symmetric data key for client-side encryption**.\\

* This operation **returns a plaintext copy of the data key and a copy that is encrypted under a CMK that you specify**.
